When you import a personal GPG key into Thunderbird (as of version 115.0.1, likely since the removal of Enigmail in version 78), that personal key is decrypted, and then re-encrypted using a random password that is stored in Thunderbird's password manager.
If you don't set a Primary Password for Thunderbird's password manager, that "key encryption password" is stored unencrypted, and thus your personal GPG key is effectively also stored on disk unencrypted (source):
How is my personal key protected?
At the time you import your personal key into Thunderbird, we unlock it, and protect it with a different password, that is automatically (randomly) created. The same automatic password will be used for all OpenPGP secret keys managed by Thunderbird. You should use the Thunderbird feature to set a Primary Password. Without a Primary Password, your OpenPGP keys in your profile directory are unprotected.
(Emphasis mine.)
I find that behavior non-obvious and dangerous:
When I imported my GPG key into Thunderbird, I had to enter the key's password, and so thought I'd have to enter it again to use the key (just like with GPG), but imagine my surprise when my key could be used without any password. I did not expect that Thunderbird would do something as dangerous as just storing my key unencrypted, without even informing me.
I have since set a Primary Password for Thunderbird's password manager, but it would be great if the need for setting a Primary Password could be emphasized (or even enforced) when importing a personal GPG key.
... View more